CVE-2026-92791 PUBLISHED

Uber Kraken through 0.1.29 fails to validate the tag parameter in the /tags/{tag} endpoint, allowing unauthenticated attackers to traverse outside the configured storage root. Attackers can use percent-encoded parent-directory segments in the tag parameter to read arbitrary files accessible to the testfs backend process.

• George Chen finder

• GitHub Issue #645
• https://github.com/uber/kraken
• DockerTagPather.BlobPath joins the repo and tag with no validation
• the testfs backend joins the entry with no traversal check
• the tag read routes carry no authentication middleware
• VulnCheck Advisory: Uber Kraken through 0.1.29 Path Traversal via tag parameter

• Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE